validate email address format when creating/updating accounts

I put this is in as protected in case one of us wanted to do additional update only user validation in a custom UserManager. I can pull it out for now until an actual use case presents itself.